Pricing
Run Guard free on your own laptop, choose Startup at $29.99 per user per month for your team, or talk to us about Enterprise.
Guard for one person, on their own laptop, plus Rune Box.
Free
Features
No account, Console, organization or central policy.
Guard for your team, hosted by Runeward Labs.
$29.99 / user / month
Features
Self-hosting is not included.
Everything, including a self-host option.
Contact us
Features
| Feature | Community | Startup | Enterprise |
|---|---|---|---|
| Plan and hosting | |||
| Price | Free | $29.99 / user / month | Contact us |
| Who it’s for | One person | A team | An organization |
| Where it runs | Your own laptop | Hosted by Runeward Labs | Hosted or self-hosted |
| Security-critical updates | Included | Included | Included |
| Support | Documentation | Email, best effort | Support SLA |
| Discover and assess | |||
| guard scan and guard assess: risky harness settings, rules and skills | Included | Included | Included |
| MCP checks: inline secrets, plain-HTTP remotes, unpinned packages | Included | Included | Included |
| AI tool and MCP server inventory, with approval state | Not included | Included | Included |
| Discovery of AI tools missing from the catalog | Not included | Included | Included |
| Detect and enforce | |||
| Hooks for seven coding harnesses: credential reads denied, secrets in tool output replaced, and secrets in prompts blocked with the human-to-AI sharing opt-in, where the harness allows | Included | Included | Included |
| AI process trees opening credential files or running credential commands | Included | Included | Included |
| Credential read followed by AI-provider traffic (macOS, Linux and Windows; no byte count on Windows yet) | Included | Included | Included |
| Screenshot uploads to ChatGPT and Claude in Chrome (macOS) | Included | Included | Included |
| Pinned MCP tool definitions, with changes reported | Not included | Included | Included |
| Approvals on endpoint harness hooks | Not included | Included | Included |
| Devices and Console | |||
| Where findings go | Your laptop only | Guard Console | Guard Console |
| Guard Console: device health, findings and device evidence timelinesLive | Not included | Included | Included |
| Organization and central policy | Not included | Included | Included |
| Signed detection catalogs delivered to enrolled devices | Not included | Included | Included |
| Self-hosted Guard Cloud and Console | Not included | Not included | Included |
| Enterprise controls | |||
| SSO and SCIM: SAML and OIDC sign-in, SCIM provisioning, enforced SSO | Not included | Not included | Included |
| SIEM and webhook exports | Not included | Not included | Included |
| Identity-provider connectors (Okta, Entra) | Not included | Not included | Included |
| Remote response: stop agent access, kill an agent, isolate a device | Not included | Not included | Included |
| Risk and agent history | Not included | Up to 90 days | Beyond 90 days |
| Evidence export bundlesLive | Not included | Not included | Included |
For deployment requirements, see deployment options.
Priced separately. Ask us about any of them.
Guard Cloud and the Console in a network with no outside connection.
Hands-on help rolling Guard out across your devices, harnesses and policy.
Response-time commitments beyond the standard support SLA, agreed in your contract.
Your own master services agreement and data processing agreement terms.
Yes. Community runs Guard on one person’s own laptop, with local findings, assessment and hooks, and includes Rune Box, the open-source sandbox for agents in automation. It has no account, Console, organization or central policy.
When it wants team visibility: every device and finding in the Guard Console, under one organization’s policy. Startup covers that at $29.99 per user per month.
Yes. Security-critical updates ship to every plan, Community included.
Startup does not include self-hosting. Enterprise includes everything, including a self-host option.
SSO and SCIM, SIEM and webhook exports, identity-provider connectors for Okta and Entra, remote response actions, risk and agent history beyond 90 days, and evidence export bundles. Self-hosting is also Enterprise-only.
Guard Cloud runs with PostgreSQL: on one host with the compose file (PostgreSQL, Guard Cloud and Caddy), or on Kubernetes with the Guard Helm chart and an external PostgreSQL. The deployment page lists what each needs.
Guard is in early access on macOS, Linux and Windows. On macOS the sensor observes and reports. Windows doesn’t report bytes sent yet.
Findings carry hashed paths, never document text. An organization can opt in to reading document labels and to retaining redacted session content. The privacy statement lists each collector and upload.
Yes. Both come with a 7-day trial. Send a request from the trial page and we’ll get in touch by email within one business day to set up your organization. We read every request ourselves.
Email [email protected] for plan questions or to get to know Runeward Labs. For support cases, use [email protected].
Get to know Runewrd Labs
Questions about Startup or Enterprise? Write to [email protected].